[hardware] 🐛 Fix two vfirst.m defects in the mask unit (#500)

[renzoandri]

Two independent vfirst.m defects in masku.sv, one commit each, smallest
first. Details and reproducers in #500.

• 1/2 — index accumulation. The accumulator added lzc's cnt_o
  unconditionally, but common_cells' lzc returns WIDTH-1 (not WIDTH) for
  an all-zero input, so vfirst.m under-reported by exactly
  floor(idx / VfirstParallelism). Advance by VfirstParallelism on an empty
  slice.
• 2/2 — stranded operands. vfirst.m terminated the instruction on the first
  set bit, leaving the operand words the lanes were still delivering for the rest
  of that vl in the per-lane MASKU operand queue, where the next mask
  instruction consumed them. Same class as masku_operands: drain ALU data during VID #448 — whose vid.v drain is not on
  main either; it arrives with 🐛 [masku] Mask-unit correctness & deadlock fixes (#446 #448 #450) #469's 69946aa. vfirst.m now runs to
  completion like vcpop.m — consuming every slice is the drain — with a
  vfirst_found_q flag so the extra slices cannot disturb the latched answer.

Cost of 2/2: vfirst.m always takes ceil(vl/VfirstParallelism) MASKU cycles,
the same as vcpop.m already does. Keeping the early exit would need a real
drain counter for the operands still in flight.

Relation to #469 — no conflict, and #469 is the better base. The two series
touch different code: #469 touches vfirst.m only at the vcpop_operand
assignment (#446's VL trim), while these commits touch the index accumulator, the
two operand-ack conditions and the out_scalar_valid condition. Verified rather
than assumed — git am -3 of this series onto #469's head (aee901c7)
auto-merges masku.sv with no conflict; only the CHANGELOG.md ### Fixed list
collides, trivially.

Stacking on #469 is also the tested configuration: the tree these fixes were
characterised on already carried equivalents of #469's two mask-unit hunks (the
#446 VL trim and the #448 vid.v drain — see the issue for the mapping), so
main + #469 + this series is what was simulated, and this series alone on
main is the untested arrangement. Both apply cleanly either way — say the word
and I'll rebase on #469, or on main first if you'd rather take these
independently.

Not #494. That open issue also names vfirst.m, but it is the missing
vstart != 0 illegal-instruction check the RVV 1.0 mandatory list requires, and
it is fixed at the decode site in ara_dispatcher.sv. This series does not touch
that file — only masku.sv and CHANGELOG.md — so the two are independent.

Changelog

Fixed

• Fix vfirst.m index under-reporting by floor(idx/VfirstParallelism) on
  all-zero mask slices
• Run vfirst.m to completion so it drains its MASKU operands, instead of
  aborting on the first set bit

Checklist

• Automated tests pass — see Verification below
• Changelog updated
• Code style guideline is observed

Verification

ara_tb_verilator, NR_LANES=2, VLEN=2048, verilator 5.044, on the pin
ab4158ae (whose masku.sv is byte-identical to main at 34bd3bc) with the
ianfield fork's #446/#448/#451 fixes applied — two of which are #469's mask-unit
hunks, as above. These two commits have not been simulated on plain main
without those, which is the other reason #469 is the base I'd suggest:

• A directed reproducer suite — 16 ELFs, 33 probes, covering the 2×2×2 factorial
  over {fault-only-first | plain load} × {mask dest overlaps load dest |
  separate} × {csrr vl | none}, plus a 10-point index sweep — goes from
  FAIL/HANG to PASS on every phase, including GCC's own compiled strlen idiom.
  The index sweep (set bit at 0, 1, 15, 16, 17, 31, 32, 33, 100, 255) is exact at
  every point.
• The mask-unit regression suite (11 variants) stays green.
• No perturbation of anything already measured: a hello_world run is
  bit-identical at 7625 cycles / 3751 instret / IPC 0.491, and an
  attention-kernel benchmark reproduces figure-for-figure (fp32 782007 scalar /
  71512 vector / 10.94×, int8 94067, max|Δy| 9.28e-4, both bit-exact).

Why the in-tree suite is green today, since that is the first thing to check:
apps/riscv-tests/isa/rv64uv/vfirst.c is the only test that executes
vfirst.m, and both its cases run at vl = 4 — one VfirstParallelism = 16
slice (a fixed localparam, not a function of NrLanes), which reaches neither
defect. Its all-zero-mask -1 expectation is the one commit 2/2 touches, and it
is preserved by construction; the CI run on this PR is what exercises it.

Note the patch adds one flop and changes MASKU control, so it has not been
re-synthesised here; the numbers above are all RTL simulation.

Provenance

Prepared with AI assistance — LLM agents did the defect analysis, drafted the two
patches, and ran the simulation campaign above. I have reviewed the series and the
numbers before sending it. Nothing here rests on taking that on trust: the
reproducers, the exact commands and the pin are all in the linked issue, so every
claim is checkable. Tell me if you would rather any part of it were reworked or
rewritten.